Log SNI in TCP mode

Help!
2

After some digging I figured it out… from a closer reading of the documentation (and code), of course. :sweat_smile:

During the ‘TCP content inspection’ phase, the the ‘tcp-request content’ rules are evaluated until ‘until either an
"accept" or a “reject” rule matches’. This means I simply need to move the capture to occur before the accept.

defaults
  log global
  mode tcp
  balance roundrobin

frontend https-in
  mode tcp
  tcp-request inspect-delay 3s
  tcp-request content capture req.ssl_sni len 10
  log-format "capture0: %[capture.req.hdr(0)]"
  tcp-request content accept if { req_ssl_hello_type 1 }
  use_backend test_0 if req.ssl_sni -m end /test

backend test_0
1 Like